Microsoft Entra ID SAML configuration

This guide describes how to configure Microsoft Entra ID as a SAML identity provider (IdP) for Workato Identity.

SAML enables secure authentication between an IdP, such as Microsoft Entra ID, and a service provider like Workato. Users authenticate once through Microsoft Entra ID and gain access to Workato with a single login instead of managing separate credentials for each application. Refer to Microsoft Entra ID SAML-based authentication (opens new window) documentation for more information.

PREREQUISITES

• Workato Identity is only available for Agent Studio, Workato GO, and MCP.

• Configure SAML-based authentication in Workato Identity before you begin. The Specify Single sign-on URL and Service provider (SP) entity ID values from that setup are required to complete the following steps.

Configure SAML authentication in Microsoft Entra ID

Complete the following steps to configure SAML authentication in Microsoft Entra ID:

NOT FOR WORKFLOW APPS SAML-BASED SSO

This documentation is specific to Workato Identity. Refer to SAML-based single sign-on authentication to configure SAML authentication for Workflow apps.

1

Sign in to the Microsoft Entra admin center (opens new window) or the Azure portal (opens new window).

2

Go to Identity > Applications > Enterprise applications and click New application.

3

Click Create your own application.

4

Enter a name for the app in the What's the name of your app? field. For example, Workato Agentic or MCP Servers.

5

Select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

6

Go to Manage > Single sign-on and select SAML as the single sign-on method.

7

Go to the Basic SAML Configuration section and click Edit.

8

Paste the Service provider (SP) entity ID from Workato into the Identifier (Entity ID) field.

9

Paste the Single sign-on URL from Workato into the Reply URL (Assertion Consumer Service URL) field.

Paste the Single sign-on URL from Workato into the Reply URL (Assertion Consumer Service URL) field

10

Click Save.

11

Go to the Attributes & Claims section and click Edit to add the following attribute statements:

Name	Value
workato_end_user_name	user.displayname
workato_end_user_groups	user.assignedroles

12

Click Save.

13

Go to Manage and select Users and groups.

14

Click Add user/group and add one or more users or groups that should have access to the application.

15

Click Assign.

16

Return to Single sign-on and scroll to the SAML Certificates section.

17

Copy the App Federation Metadata URL. You must use this URL in the Do you have your identity provider metadata URL? section of the Set up a new provider modal in Workato Identity.

18

Return to your Microsoft Entra ID account and go to Properties.

19

Set Visible to users? to No to prevent the app from appearing in the user's app launcher.

DIRECT SIGN-IN FROM IDP UNSUPPORTED

You can't sign in to Workato directly from your IdP. Authentication is only supported when initiated through a conversation in your connected LLM.